Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?

share|improve this question

4 Answers 4

up vote 1 down vote accepted

You can do it with ipclog & constat

share|improve this answer

The -p option of netstat allows to get the process ID of the process that initiated the connection.
Used in conjunction with the -a (all) and -n (numeric) options

  netstat -anp

The list of sockets is displayed along with useful information

  unix 3  [ ]  STREAM   CONNECTED  60670  7392/firefox-bin

Using ps -ef (or psgrep) get the information associated to the 7392 process, like STIME

  ps -ef | grep 7392

  UID  PID  PPID  C STIME TTY      TIME CMD
  me  7392  7388  2 09:37 ?    00:01:34 /usr/lib/firefox-3.6.10/firefox-bin

The process was started at 09:37.

share|improve this answer
    
This only state that the process has started at a certain time it does not provide any information about a specific connection time. Firefox that you give in example, he will establish a lot of connection for the many pages that you open the time of firefox runing has no related information of what time took a connection. –  Gopoi Oct 9 '10 at 3:08
    
@Gopoi Of course, this is just an example. I assume the author knows the difference between a process and a connection. This will be relevant if the process starts the connection at first, and dies with it. –  ring0 Oct 9 '10 at 9:15

I have never seen any network structures for holding time a connection was established. The information can be logged by stateful firewalls. However, they only track when the last activity occurred.

In some cases, it is roughly derivable from when the process to servicing the connection was created.

share|improve this answer

No I checked at the man page of netstat and there is no way of knowing the time of an established connection using netstat.

And I don't think it is stored anywhere because connection are so dynamic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.